Adrian Pastor

In streams mode, the management HTTP API is exposed on `0.0.0.0:4195` without authentication enabled by default, leaving stream CRUD routes unprotected. An unauthenticated attacker with network access to TCP/4195 can send a `POST` request to the `/streams/{id}` endpoint with a malicious pipeline definition. By utilizing code-executing processors such as `command`, `subprocess`, `ffi`, or unsafe `sql raw`, the attacker can achieve arbitrary remote code execution (RCE) on the host with the permissions of the service account. This allows for full host compromise, credential theft, and data exfiltration, as pipelines can return command output in-band via HTTP.

A cross-site request forgery (CSRF) issue exists in the web interface, allowing remote attackers to hijack the authentication of administrators for requests that change settings.

The issue allows remote attackers to inject arbitrary web script or HTML via the query string to the ping program or other aspects of the URI, due to an input sanitization error in the embedded HTTP server. This could enable an unauthenticated, remote attacker to execute arbitrary HTML and script code in the user's browser session by convincing a user to follow a malicious link.

The issue allows remote attackers to easily obtain sensitive information or modify variables due to the default SNMP read/write community being set to public.

The issue allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering. This occurs because the content filtering system's block page does not properly handle the input, leading to a cross-site scripting (XSS) vulnerability. This can be used for "universal website hijacking."

Cross-site scripting (XSS) vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258, and other versions before 5.3.3.378, allows remote attackers to inject arbitrary web script or HTML via a URL-encoded postdata parameter. NOTE: this is different than CVE-2005-1118, but it might be the same as CVE-2008-1470.

The issue concerns the handling of user authentication states. Specifically, it does not record users' authentication states and implements the logout feature solely on the client side. This makes it easier for context-dependent attackers to reuse a logged-out session.

The issue allows remote attackers to obtain access by sniffing the network, as a base64 encoded form of the `username` and `password` is placed in the ` ac` cookie for all user accounts.

The issue allows remote attackers to gain permanent access to an account by sniffing the network, due to the use of invariant data when calculating an HMAC-SHA1 value for an authentication cookie. This makes it easier for attackers to exploit the system.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to perform certain actions without the victim's consent. Specifically, attackers can (1) add arbitrary accounts via the "join form" page and (2) change the privileges of arbitrary groups via the "prefs groups overview" page.

The issue allows remote attackers to obtain administrative privileges by sniffing the network, as a base64 encoded form of the `username` and `password` is placed in the " ac" cookie for the admin account.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the query string to specific API endpoints, such as "my.activation.php3" and "my.logon.php3", when pre-logon sequences are enabled.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the `nextPage` parameter in the /idm/user/login.jsp endpoint.

The issue allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via the `helpUrl` parameter. This is related to the `/idm/help/index.jsp` endpoint.

The issue allows remote attackers to obtain sensitive information. This is achieved via a direct request to "getpath.aspx", which reveals the installation path in an error message.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `backurl` parameter in the download plugin.php3 file.

Name of the Vulnerable Software and Affected Versions: Thomson/Alcatel SpeedTouch 7G router versions 6.2.6.B and earlier Description: The issue allows remote attackers on an intranet to bypass authentication and gain administrative access. This can be achieved via vectors including a '/' (slash) character at the end of the PATH INFO to `cgi/b`. Additionally, remote attackers outside the intranet can exploit this by leveraging a separate CSRF vulnerability. Recommendations: For versions 6.2.6.B and earlier, as a temporary workaround, consider restricting access to the `cgi/b` endpoint to minimize the risk of exploitation. Avoid using the '/' character at the end of the PATH INFO to prevent bypassing authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Thomson/Alcatel SpeedTouch 7G router versions 6.2.6.B and earlier Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations: For versions 6.2.6.B and earlier, update to a version later than 6.2.6.B to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Thomson/Alcatel SpeedTouch 7G router versions 6.2.6.B and earlier BT Home Hub version 6.2.6.B and earlier SpeedTouch 780 (affected versions not specified) Description: The issue allows remote attackers to perform actions as administrators via unspecified POST requests. This can be demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. An authentication bypass can be leveraged to exploit this issue in the absence of an existing administrative session. Recommendations: For Thomson/Alcatel SpeedTouch 7G router versions 6.2.6.B and earlier, consider restricting access to administrative functions until a fix is available. For BT Home Hub version 6.2.6.B and earlier, restrict inbound remote-assistance HTTPS sessions on TCP port 51003 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows remote attackers to bypass request filtering, which can lead to cross-site scripting (XSS) attacks or cause a denial of service. This can be achieved by exploiting the improper handling of comment enclosures, for example, via an xss:expression STYLE attribute in a closing XSS HTML tag.